Twitter is notifying developers today about a possible security incident that may have impacted their accounts.
The incident was caused by incorrect instructions that the developer.twitter.com[1] website sent to users' browsers.
The developer.twitter.com website is the portal where developers manage their Twitter apps and attached API keys, but also the access token and secret key for their Twitter account.
In an email sent to developers today, Twitter said that its developer.twitter.com website told browsers to create and store copies of the API keys, account access token, and account secret inside their cache, a section of the browser where data is saved to speed up the process of loading the page when the user accessed the same site again.
This might not be a problem for developers using their own browsers, but Twitter is warning developers who may have used public or shared computers to access the developer.twitter.com website — in which case, their API keys are now most likely stored in those browsers.
"If someone who used the same computer after you in that temporary timeframe knew how to access a browser's cache, and knew what to look for, it is possible they could have accessed the keys and tokens that you viewed," Twitter said.
"Depending on what pages you visited and what information you looked at, this could have included your app's consumer API keys, as well as the user access token and secret for your own Twitter account," Twitter said.
Twitter said it fixed the issue by changing what content gets cached when users access the developer.twitter.com portal.
The social network also said it has no indication that any API keys have leaked this way, as an attacker must have (1) known about the bug, and (2) had access to a developer's